IN THE CLAIMS: 

1 . (Previously Presented)A method in a data processing system for tracking 
relationships between programs and data, the method comprising: 

receiving a file access request from a program, wherein the file access request is 
for a file and is received at an operating system level; 

identifying an association between the file and the program requesting the file 
access in response to receiving the file access request; and 

storing the association between the file and the program, wherein the association 
is used for subsequent accesses to the file such that a stored association is stored for each 
file for which file access is requested by the program. 

2. (Original)The method of claim 1, wherein the association is stored as meta data. 

3. (Original)The method of claim 1, wherein the association includes a file name for 
the file and a program name for the program. 

4. (Original)The method of claim 3, wherein the association fiirther includes at least 
one of a location of the file, a time of file access, a date of file access, an extension for 
the file, and an identification of a user of the program. 

5. (Original)The method of claim 4, wherein the location of the file is in a remote 
data processing system. 

6. (Original)The method of claim 1, wherein the file request is one of a request to 
open the file, close the file, copy the file, or delete the file. 

7. (Original)The method of claim 1, wherein the program is a first program and 
wherein a request to open the file originates fi-om the first program and a request to close 
the file originates fi'om a second program. 

Page 3 of 16 
Mastriaimi et al. - 09/865,243 



8. (Original)The method of claim 7, wherein the association includes the second 
program. 

9. (Previously Presented)The method of claim 1, wherein the receiving step, the 
identifying step, and the storing step are performed within an operating system kernel. 

10. (Previously Presented)The method of claim 1, wherein the receiving step, the 
identifying step, and the storing step are performed within a device driver. 

11. (Original)The method of claim 10, wherein the drive driver intercepts calls 
directed to a mechanism used as a point of entry for the access. 

12. (Original)The method of claim 1, wherein the storing step comprises: 
storing the association between the file and the program in a database. 

13. (Original)The method of claim 1, wherein associations are stored in a database 
and further comprising: 

receiving a request from a requestor to access the associations; 

querying the database for the associations; 

receiving a result from the database; and 

returning the result returned from the database to the requestor. 

14. (Original)The method of claim 13, wherein the associations are for a particular 
program. 

15. (Original)The method of claim 13, wherein the associations are for a particular 
file. 

16. (Original)The method of claim 1, wherein the storing step comprises: 
storing the association between the file and the program in at least one of a 

registry, file, and a file system. 
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1 7. (Previously Presented)A data processing system comprising: 
a bus system; 

a communications unit connected to the bus system; 

a memory connected to the bus system, wherein the memory includes as set of 
instructions; and 

a processing unit connected to the bus system, wherein the processing unit 
executes the set of instructions to receive a file access request from a program, wherein 
the file access request is for a file and is received at an operating system level; identify an 
association between the file and the program requesting the file access in response to 
receiving the file access request; and store the association between the file and the 
program, wherein the association is used for subsequent accesses to the file such that a 
stored association is stored for each file for which file access is requested by the program. 

18. (Original)The data processing system of claim 17, wherein the bus system is a 
single bus. 

19. (Original)The data processing system of claim 17, wherein the bus system 
includes a primary bus and a secondary bus. 

20. (Original)The data processing system of claim 17, wherein the processing unit 
includes a plurality of processors. 

21. (Original)The data processing system of claim 17, wherein the communications 
unit is one of a modem and Ethernet adapter. 

22. (Previously Presented)A data processing system for tracking relationships 
between programs and data, the data processing system comprising: 

receiving means for receiving a file access request from a program, wherein the 
file access request is for a file and is received at an operating system level; 
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identifying means for identifying an association between the file and the program 
requesting the file access in response to receiving the file access request; and 

storing means for storing the association between the file and the program, 
wherein the association is used for subsequent accesses to the file such that a stored 
association is stored for each file for which file access is requested by the program. 

23. (Original)The data processing system of claim 22, wherein the association is 
stored as meta data. 

24. (Original)The data processing system of claim 22, wherein the association 
includes a file name for the file and a program name for the program. 

25. (Original)The data processing system of claim 24, wherein the association further 
includes at least one of a location of the file, a time of file access, a date of file access, an 
extension for the file, and an identification of a user of the program. 

26. (Original)The data processing system of claim 25, wherein the location of the file 
is in a remote data processing system. 

27. (Original)The data processing system of claim 22, wherein the file request is one 
of a request to open the file, close the file, copy the file, or delete the file. 

28. (Original)The data processing system of claim 22, wherein the program is a first 
program and wherein a request to open the file originates fi-om the first program and a 
request to close the file originates from a second program. 

29. (Original)The data processing system of claim 22, wherein the association 
includes the second program. 
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30. (Previously Presented)The data processing system of claim 22, wherein the 
receiving means, the identifying means, and the storing means are located within an 
operating system kernel. 

3 1 . (Previously Presented)The data processing system of claim 22, wherein the 
receiving means, the identifying means, and the storing means are located within a device 
driver. 

32. (Original)The data processing system of claim 3 1 , wherein the drive driver 
intercepts calls directed to a mechanism used as a point of entry for the access. 

33. (Original)The data processing system of claim 22, wherein the storing means 
comprises: 

means for storing the association between the file and the program in a database. 

34. (Original)The data processing system of claim 22, wherein associations are stored 
in a database, wherein the receiving means is a first receiving means, and further 
comprising: 

second receiving means for receiving a request fi-om a requestor to access the 
associations; 

querying means for querying the database for the associations; 
third receiving means for receiving a result fi'om the database; and 
returning means for returning the result returned from the database to the 
requestor. 

35. (Original)The data processing system of claim 34, wherein the associations are for 
a particular program. 

36. (Original)The data processing system of claim 34, wherein the associations are for 
a particular file. 
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37. (Original)The data processing system of claim 22, wherein the storing means 
comprises: 

means for storing the association between the file and the program in at least one 
of a registry, file, and a file system. 

38. (Previously Presented) A computer program product in a computer readable 
medium for tracking relationships between programs and data, the computer program 
product comprising: 

first instructions for receiving a file access request from a program, wherein the 
file access request is for a file and is received at an operating system level; 

second instructions for identifying an association between the file and the 
program requesting the file access in response to receiving the file access request; and 

third instructions for storing the association between the file and the program, 
wherein the association is used for subsequent accesses to the file such that a stored 
association is stored for each file for which file access is requested by the program. 

39. (Original)The computer program product of claim 38, wherein the association is 
stored as meta data. 

40. (Original)The computer program product of claim 38, wherein the association 
includes a file name for the file and a program name for the program. 

41 . (Original)The computer program product of claim 40, wherein the association 
fiirther includes at least one of a location of the file, a time of file access, a date of file 
access, an extension for the file, and an identification of a user of the program. 

42. (Original)The computer program product of claim 41, wherein the location of the 
file is in a remote data processing system. 

43. (Original)The computer program product of claim 38, wherein the file request is 
one of a request to open the file, close the file, copy the file, or delete the file. 
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44. (Original)The computer program product of claim 38, wherein the program is a 
first program and wherein a request to open the file originates from the first program and 
a request to close the file originates from a second program. 

45. (Original)The computer program product of claim 38, wherein the association 
includes the second program. 

46. (Previously Presented)The computer program product of claim 38, wherein the 
first instructions, the second instructions, and the third instructions are located within an 
operating system kernel. 

47. (Previously Presented)The computer program product of claim 38, wherein the 
first instructions, the second instructions, and the third instructions are located within a 
device driver. 

48. (Original)The computer program product of claim 47, wherein the drive driver 
intercepts calls directed to a mechanism used as a point of entry for the access. 

49. (Previously Presented)The computer program product of claim 38, wherein the 
third instructions comprises: 

sub-instructions for storing the association between the file and the program in a 
database. 

50. (Previously Presented)The computer program product of claim 38, wherein 
associations are stored in a database and further comprising: 

fourth instructions for receiving a request from a requestor to access the 
associations; 

fifth instructions for querying the database for the associations; 
sixth instructions for receiving a result from the database; and 
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seventh instructions for returning the resuh returned from the database to the 
requestor. 

5 1 . (Original)The computer program product of claim 50, wherein the associations 
are for a particular program. 

52. (Original)The computer program product of claim 50, wherein the associations 
are for a particular file. 

53. (Previously Presented)The computer program product of claim 38, wherein the 
third instructions comprises: 

sub-instructions for storing the association between the file and the program in at 
least one of a registry, file, and a file system. 
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